How to allow PHP loading from one domain?

Question

In the HTML form I wrote, the user can upload the file sent when submitted using ajax. The script is located at exampledomain.com/upload.php.

I want to avoid a situation where someone is going to create their own form with an action pointing to upload.php and start sending out my server using unauthorized files.

Everyone can fill out my HTML form, so login / password for downloading is not an option for me. Is there an effective way to make sure upload.php will only run from an HTML form on my website?

One way to solve this problem is to use sessions, but I'm not sure how well it works with ajax. Any suggestions?

Answer 1

Although Cross-Site Request Forgery is usually classified as an attack on already verified user accounts through another site, the methods used to deal with it will work for you to some extent, although, as you say, your users are not authenticated as such.

, unce ( ) , Jeff Atwood, , POSTing - , nonce, POST, , , , , -, "" - .

, nonce , .. . , , , CAPTCHA s, .

, ( , , CAPTCHA , , ), , CAPTCHA, , . , - , .

(, Ajax - , , Ajax, , - . .)

Answer 2

, - , upload.php, .

.

PHP ?

, "", .

, . .

Answer 3

- captcha ( recaptcha). , , - ( clrf), $_SERVER [''],

Answer 4

PHP , , , , , .

upload.php, .

.

Answer 5

You can also calculate the size of the file uploaded to Kbytes and attach this integer to the session variable and check this variable on the next landing page after logging in!